attack.t1027.010

Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix

Nov 27, 2025 · attack.execution attack.t1204.004 attack.defense-evasion attack.t1027.010 ·

Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.

Suspicious Usage of For Loop with Recursive Directory Search in CMD

Nov 21, 2025 · attack.execution attack.t1059.003 attack.defense-evasion attack.t1027.010 ·

Share on:

Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files.

Suspicious Space Characters in RunMRU Registry Path - ClickFix

Nov 5, 2025 · attack.execution attack.t1204.004 attack.defense-evasion attack.t1027.010 ·

Share on:

Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.

Suspicious Space Characters in TypedPaths Registry Path - FileFix

Nov 5, 2025 · attack.execution attack.t1204.004 attack.defense-evasion attack.t1027.010 ·

Share on:

Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.

Obfuscated PowerShell MSI Install via WindowsInstaller COM

Jun 4, 2025 · attack.defense-evasion attack.t1027.010 attack.t1218.007 attack.execution attack.t1059.001 ·

Share on:

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (WindowsInstaller.Installer). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of InstallProduct and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

Potential Obfuscated Ordinal Call Via Rundll32

Feb 25, 2025 · attack.defense-evasion attack.t1027.010 ·

Share on:

Detects execution of "rundll32" with potential obfuscated ordinal calls

Gamarue Rundll32.exe Long Commandlines

Mar 26, 2024 · attack.defense_evasion attack.t1027 attack.t1027.010 ·

Share on:

Fortunately for defenders, Gamarue is detectable with endpoint telemetry. The majority of Gamarue activity we see involves rundll32.exe executing with unusual command lines that include long filenames with repeating characters and random function names. Part of the RedCanary 2024 Threat Detection Report.